Show HN: A web-based matrix client: Cinny | Hacker News Reader

Show HN: A web-based matrix client: Cinny

github.com

163 pointskfiven72 comments

Link to the actual app https://app.cinny.in/login

__________

EDIT: Upon registration "Password must contain 1 number, 1 uppercase letters, 1 lowercase letters, 1 non-alpha numeric number, 8-16 characters with no space."

Not sure if that's a Matrix limitation or just javascript validation, but if it's on your end please don't do that... if anything you're enforcing less secure passwords.

__________

EDIT 2: Hitting reload on https://app.cinny.in/register leads to a 404

Note, some of that is a requirement by the Matrix protocol and is out of clients control. It's ultimately up to the server to configure different password requirements.

https://matrix.org/docs/spec/client_server/latest#notes-on-p...

> Clients SHOULD enforce that the password provided is suitably complex. The password SHOULD include a lower-case letter, an upper-case letter, a number and a symbol and be at a minimum 8 characters in length. Servers MAY reject weak passwords with an error code M_WEAK_PASSWORD.

Why is this still a thing? I think all tech people hate it, and all non-tech people use "Password1".

Some tech people hate it so much that they delegate it to a password manager. ;)

As a side-note, I wish I could give lastpass a regex or pattern or something to check auto-generate guesses against (it would be great to have a [trusted] library of these, too). I often end up regenerating or tweaking my auto generate settings a few times for every new account I create to get around this stuff.

Password managers are great until you need to log in on someone else’s machine. Especially when you don’t have your device on you. It’s bitten me before.

If you have hundreds of unique passwords, I don't see an alternative unless you're a savant or use predictable patterns. But that doesn't mean there aren't ways to get around it. For one, using a password manager shouldn't stop you from remembering your most important passwords, especially those you expect to use in other people's machines. You can take some extra care to make these important passwords easy to remember while still being secure. I could go on but everything I'd say is quite obvious.

Oh I use a password manager too. Just pointing out it isn’t a catch all

Not to be overly pedantic, but SHOULD is not a requirement according to https://www.ietf.org/rfc/rfc2119.txt, but a recommendation that should be fully understood before making a different decision. I fully agree that it should be a different measure of complexity though!

While it can, my opinion is the client and server should not enforce anything about password strength, but MAY warn the user about weak passwords.

The criteria that I think would be acceptable to be enforced includes:

- A maximum (not a minimum) length, which must be suitably long, perhaps 200 bytes (or longer).

- Rejecting passwords containing null bytes.

- Rejecting passwords containing sequences of bytes that cannot be transmitted using the protocol, if it is necessary to transmit the password using the protocol at all (which it might not be, since it might use a hash instead). (This depends on the protocol.)

- If despite the advice above, the client knows that the server will reject other passwords too, and knows precisely what the criteria are, the client can reject the same passwords.

Examples of some things that should be allowed (and should not be rejected) include:

- Passwords that are short.

- Passwords that include your username as a substring.

- Character classes/lack of character classes (e.g. you should not require nor prohibit punctuation).

- Control characters (if not causing problems with the protocol like mentioned above).

- Invalid UTF-8 sequences.

(Just because they are allowed though, does not necessarily mean that they should be recommended.)

Also, passwords should always be case-sensitive.

The user should decide by themself what password they want to set, although it is OK to include advice that is optional.

The max limit of 16 characters is odd.

As for the other requirements, it's just a matter of enabling various options in your password manager's generator. And if you're not using a password manager, it's very probable you're using/reusing insecure passwords.

And if that's still not you then you probably are using/reusing a secure password that thankfully seems to be accepted by most sites!

> reusing a secure password

congratulations, it’s no longer a secure password

Sod42Off!

I wonder how often 42 and 1337 are used in passwords.

There are some issues related to /login and /register, but https://app.cinny.in should work fine.

Using safari's "password suggestion" generated password gives error:

"Password must contain 1 number, 1 uppercase letters, 1 lowercase letters, 1 non-alpha numeric number, 8-16 characters with no space."

Even an example password:

apPa4SRODhLWcUa/x9HbqA==

which passes all the requirements doesn't work.

I would really like to use this.

I struggled with this too. The password is too long, I had to make mine shorter

Thanks, that helped.

This direct link will 404: https://app.cinny.in/login

But if you go to the homepage (index.html) and click on Login it will do the weird little SPA routing thing and load the page correctly.

I'm guessing netlify needs to route every URL path to the index.html?

SPA apps have just fundamentally broken the web.

No that's not a Netlify thing, it's most likely how the website is just configured.

That's not a SPA breaking the web, it's just misconfigured.

Technically yes, but the fact that SPAs require explicit and extra code/configuration to make them work when this functionality (url nav) is a works-by-default inherent part of the web's core design makes them arguably broken by design.

I think that maximum 16 characters is way too short. Perhaps 127 bytes might be a suitable maximum, although it should be more if possible. (This does not mean that you are required to enter a password of at least that length; it is only the maximum length, not the minimum length.)

This is the smallest thing in the world but: in the screenshot on cinny.in: that's my chicken illustration! :D (Not my chicken, she belongs to https://www.instagram.com/chooks_in_town/ so I also put the illo on IG https://www.instagram.com/p/CRQETITJncO/)

More substantively: the look of this is so nice. My biggest complaint with element is UX around cross-signing (though I'd also switch in a heartbeat if someone hacked in voice messages somehow). How have you found all that to implement? (Totally fine if it's still on a roadmap, I'm just curious)

I believe it would please you to know Voice Messages are currently front in line to be implemented next.

ho ho HO your belief is correct!

I don't see any chicken anywhere? This is the screenshot that shows up: https://cinny.in/assets/preview-light.png

I also tried changing the "light" in the url to "dark" and got https://cinny.in/assets/preview-dark.png

They are referring to the chicken on the home page with the second theme (non-pure white) selected:

https://cinny.in

Image:

https://cinny.in/assets/preview-silver.png

busymom0 had it right -- I meant the preview for the silver theme :)

This is gorgeous! Have you considered adding it to matrix.org/clients?

It would also be interesting to know a little bit more how the hard features are implemented. Key exchange and cross signing in E2EE? Plans for "native" VoIP?

PRs are welcome against github.com/matrix-org/matrix.org to list clients :)

(it looks like cinny is built on matrix-js-sdk, which also powers element web, so inherits the e2ee support and could inherit voip etc from there).

First impression: very nice look and feel, definitely prettier and much snappier than Element.

It does lack a lot of basic features though (like reply, editing/deleting messages, ...).

Totally understandable, of course, but React apps always tend to be fast early on but slow down as more and more features are added.

I appreciate, so much, that you call out and focused on proper spacing for layout.

This is hands down my biggest pet peeve with so many open source projects and an outright reason I won't use some of them.

Amazing job.

i wonder if the Show HN link should be changed to go straight to https://cinny.in?

The app is really impressively well done - goes to show how well an entirely fresh React app can run on top of matrix-js-sdk (and thus how much snappier Element can be :)

It looks like I can not change it now.

@dang can change it, though

Looks very nice! I will have to try it. Do you have plans to announce it to matrix.org's This Week In Matrix (TWIM) updates? If you're looking for more testing and feedback I'm sure you'll get some from the visibility there.

It's already been posted to the TWIM room so it should be in it.

Wow, this is really well done. I love how fast it is. Any plans on making an electron desktop app? I would definitely use it.

Heck if it's a general purpose web app - ie not only Chrome, maybe give Tauri[1] a try?

[1]: https://github.com/tauri-apps/tauri

Yes, after some more features we gonna make electron app.

As others have said, perhaps Tauri would work better (and save you from neverending complaints from the anti-electron brigade)

As a side note, being someone who is quite interested in matrix as a technology, could anyone recommend any good and active rooms (or spaces, if that's a thing now) on matrix? The only ones I can find are mostly for asking questions about specific programming languages or technologies.

tech heavy, but sort of a general chat: AfediverseChat: https://matrix.to/#/!TwVRDXcJyTivqGQvWF:matrix.org

You gotta follow TWIM. It’s the room where things get announced to make it into their Friday post on This Week In Matrix.

So dumb question about Matrix.. any long-time IRCers use it? How did you make the transition? Is it straight forward to use weechat with it? If you abandoned the irc client, is it easy to keep personal logs?

The matrix core team was very much long-time IRCers (opering networks since late-90s) before we embarked on Matrix, so we've tried to make it a decent transition. The python weechat-matrix plugin is pretty good (in my opinion, although others seem to have had bad experiences). Matrix itself stores your conversation history for you, so most people don't bother storing separate logs. There are tools to let you maintain separate logs though, e.g. https://github.com/russelldavies/matrix-archive - and log export is also currently being added to Element.

> ...any long-time IRCers use it?

If it is any consolation, Mozilla (yes, that Mozilla!) moved over from irc to matrix back in 2020 if i recall correctly. So, i imagine that would represent a large-ish number of irc users, and many likely had been using irc for quite some time now. See: https://discourse.mozilla.org/t/synchronous-messaging-at-moz... and https://wiki.mozilla.org/IRC

Looks very clean. I'm looking forward to a more capable version of Cinny.

The validation on the login page is a bit annoying though. I'd like to paste a Matrix address like @username:domain.org.

You can paste localpart with @ also. So @username in username and domain.org in Homeserver.

Really wanted to try this, and am still looking forward to at some point, but for some reason my password is invalid to the client and presents 'M_FORBIDDEN: Invalid password' despite it being a cryptographically secure random-gen password in my vault - presumably because it doesn't have a special character in it.

It would be cool if this limitation was a little more up front - While I can spin up a copy on my own and adjust the limitation myself, I don't think everyone's going to want to do that.

When will we get native, beautiful, and fast Matrix clients? I am very tired of Electron and web applications, I want a snappy experience for once. Please.

Like an old engineering mantra, "I can give you 2 out of 3"...Jokes aside, the matrix.org website does have a nice page listing the different clients (that they at least know about), and its nicely broken up into sections for mobile, desktop, terminal, and even nintendo (!). There are a number of native clients and some (e.g. nheko, quaternion) i have unscientifically found to be very fast...as far as beautiful, well, i think it would be best to leave that to you as your opinion. Here's the client list page that i referenced above: https://matrix.org/clients/

I hope that helps!

Wow, it really has a great first impression! The visual and feel is just amazing - and even basic E2EE seems to be available.

I'm definitely sold and following along with developments

So looking at the site, this seems to be only client code? If nothing needs to be installed or run on a server, then this will be huge!

Looking forward to trying this out later today.

Nice work!

this is just a client for the matrix protocol. There are several server implementations

matrix.org

Explain to me again why it isn't crazy to type your username and password into the login form of some random webpage you've never heard of?

you should really use a test account when experimenting with random matrix clients. meanwhile we’re looking at adding OAuth 2 to Matrix by default so your server is the one that auths you, rather than a random client: https://github.com/matrix-org/matrix-doc/pull/2964#issuecomm...

This site is requiring an email address to register a matrix.org account. Odd.

Then I'm guessing it has a captcha. I'm not sure because it fails to load with Privacy Badger enabled.

My attention just wandered away. Hopefully they can address some basic privacy concerns and get another at-bat.

Edit: Seems that matrix.org is now requiring an email address.

yup, we mandate email on matrix.org atm as an anti spam measure

CAPTCHA is enforced by server itself, so client is just following that.

i love the design

any plans for mobile? maybe give react native and react-native-web a try!

First priority is a somewhat regularly usable responsive PWA for desktop as well as mobile.

sure, thanks for getting back!

Really happy to see more implementations with the Matrix protocol. The official implementations leave a little to be desired so it's good to see different takes on it.

I thought there will be a downloadable desktop app....

Does matrix support threads?

Threading is on the roadmap and should be coming Soonish (prototypes of it are already implemented in Dendrite, matrix.org's beta server).

Until then, it does support Reply messages similar to Discords.

A that's good to hear. It's basically the last missing feature that hold my company back from using matrix. BTW, Discord does have threads now.

this is a great app! I am literally hooked to it.

Reply on news.ycombinator.com